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Abstract 

This paper is intended to demonstrate the feasibility of a 
solution to a fault tolerant control problem. It explains, 
through a numerical example, the design and the operation 
of a novel scheme for fault tolerant control. The funda- 
mental principle of the scheme was formalized in [o] based 
on the notion of normalized nonspecilicity. The novelty 
lies with the use of a reliability criterion for redundancy 
management, and therefore leads to a high overall system 
reliability. 

1. Introduction 

The relationship between the overall control system relia- 
bility and control/diagnostic/redundancy management was 
discussed in [ 5 ], which provides a guideline for high reli- 
ability designs. In the process of such a design however, 
calculations are required for control system performance, 
diagnostic resolution, and reconfiguration coverage. These 
calculations are shown to be feasible in this paper by an 
example. 

The plant model to be used in our example is taken from /i- 
toolbox (See [1] and references therein) with some changes 
in the system description and design objectives. The model 
has two inputs: elevon command and canard command; two 
outputs: angle of attack and pitch angle; and four states: 
forward velocity, angle of attack, pitch rate and pitch an- 
gle. Control objectives were originally specified on vertical 
transition, pitch pointing and direct lift. The elevons are 
regarded as the primary control effectors, and the canards 
as the secondary. Therefore, some aerodynamically redun- 
dant control authority exists in the pitch axis. The same 
model has been used by the author in a .number of other 
studies related to fault tolerant control [ 2 , 3, 4]. 

The organization of the paper is as follows. The issue of 
control performance evaluation for a set of controllers is dis- 
cussed in Section 2, and control performance is evaluated 
for the above described model which is subject to a certain 
adverse operating conditions. The result of on-line estima- 
tion of the adverse conditions is presented in Section 3, with 
a focus on how the uncertainty associated with the estimate 
is represented. Section 4 describes a redundancy manage- 
ment criterion, based on which a control selection process 
is simulated. The selection process combines the informa- 
tion obtained from a control performance evaluation with 
that obtained from an adverse condition estimation. Some 
unresolved issues for future study are briefly discussed in 
Section 5. 

2. Control design and performance evaluation 

In this section, the pitch axis controller of the above system 
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is considered. The controller is required to be capable of 
accommodating adverse conditions associated with loss of 
control effectiveness. This is accomplished by designing a 
set of cent rollers, each of which compensates a certain set 
of adverse conditions. The state-space linear model 

x(T = Ax(t) + Bu{t) y y(t)=Cx(t ), x(0) = x 0 

derived at a fixed operating point is used. The following 
modifications to the original model are made. The im- 
pairment representing the loss of actuator effectiveness is 
parameterized by actuator effectiveness factors. The fac- 
tors ent ?r the model in the form B = Bo + where 

A = dia g {Si, 6 2 }. Each 6 , ranges between 0, representing 
no loss of effectiveness, and — 1 , representing complete loss 
of effectiveness in the ith effector. One of the frequency 
dependent weighting factors reflecting multiplicative plant 
uncertainty in the original design [ 1 ] is changed to a small 
constanl value to ease the change detection, because this 
uncertainty enters the plant model at the same location as 
the act uator effectiveness factors. 

Two controllers are designed for two different nominal val- 
ues of ( 61 , 62 ). For each controller, a closed-loop perfor- 
mance measure is calculated in terms of 1 // 4 , as a function of 
61 and 1 2 , where p is the structured singular value[l] of the 
closed- loop system. Both the controller design and the per- 
formance evaluation are carried out using the /x-toolbox[I]. 
The results of control performance evaluation are plotted in 
Fig.l. Also shown in Fig.l is a plane indicating prescribed 
performance level mr- When the control performance level 
falls below this threshold, a failure is declared. This thresh- 
old, together with the evaluated control performance sur- 
faces, determine the performance recoverable region. The 
challenge of recovering the control performance lies with 
the fact that at any given time the value of ( 61 , 62 ) is not 
known . 

3. Control effectiveness estimation and uncertainty 
representation 

In this section issues related to the estimation of severity 
of loss of control effectiveness is discussed. The uncertainty 
description of the estimate is converted into possibilistic 
terms. This allows us, in the process of controller selection, 
to fuse the information obtained through estimation with 
that through control performance evaluation. The informa- 
tion fusion will be discussed in the next section. 

The task of control effectiveness estimation is accom- 
plished by using an adaptive Kalman filtering algorithm. 
The reader is referred to [4] for an estimation performed 
on the same plant model. An important feature of this 
estimation algorithm is that a set of covariance-dependent 
forgetting factors is introduced into the part of the filtering 


algorithm that estimates the control effectiveness. As a re- 
sult, the change in the control effectiveness is accentuated 
to help achieve a more accurate estimate more rapidly. 

For any estimate to be useful in decision making, it must 
be accompanied by a description of uncertainty. Fig. 2(a) 
shows the probability density function of the estimate of 
control effectiveness obtained 2.5 seconds into the system 
operation, and 0.3 seconds after a simulated adverse con- 
dition at («5 i,< 5 2 ) = (-0.85,-0.65) has occured. This prob- 
ability distribution is then transformed under the uncer- 
tainty invariant principle[5] into the possibility distribution 
shown in Fig. 2(b). 

4. Redundancy management 

By combining Fig.l and Fig. 2(b), it is clear that a redun- 
dancy management policy is needed in order that the most 
suitable controller is selected at any given time. This sec- 
tion discusses the policy and calculation of the risk associ- 
ated with each decision. 

Define F = ((<5i, <5 2 ), m F (<5i, <fe)), as the fuzzy set associ- 
ated with the possibility function of estimate (6i, <5 2 ), where 
ra denotes a membership function. Fig. 2(b) gives an exam- 
ple of F. Define Ck = ((<5i, 6 2 ), mc k (£\ . ^ 2 )). fc = 1, 2 as 
the fuzzy set representing the control performance resulted 
from using controller k. Fig. 1(a) depicts both C\ and C 2 . 
Now assume that Ck is being used. Express F as the union 
of two sets F = Ffc U Fj* where 

Ffc = {F : mc k > mr}. F* = {F : mc k < %}• 

Let c k , k — 1, 2, denote the likelihood of successful failure 
accommodation when controller k is selected. More specif- 
ically, 

Jo 1 MLCF^da _ /„ HH a Fi)da 
f 0 ' HL{ a F)da ’ ° k / 0 l IIL( a F)da ’ 

where Q F is the a-cut of fuzzy set F. HL{.) denotes the 
Hartley-like measure [5] 

2 2 

HL(A) — min t eT{log 2 [J^J(1 + |Att|) 4- \A\ - JJ \Au\]}, 

i=l i= 1 

where T is the set of all unitary transformations on the N- 
dimensional Euclidean space, \Au\ is the Lebesgue measure 
of the projection of set A on to the ith axis of the uni- 
tary transformed coordinate system under transformation 
t. Ck and 1 - Ck (which can be shown to be no greater than 
Ck under some conditions) are called the upper bound and 
the lower bound of fault tolerance coverage for controller k, 
respectively. The redundancy management policy 

argmax{ck, k= 1,2} 

k 

is used, under w'hich the controller that maximizes the like- 
lihood of successful accommodation of the given uncertain 
adverse condition is selected. The reader is referred to [5] 
for a rigorous treatment and proofs of the properties of this 
redundancy management policy. 

For the adverse condition simulated in the previous sec- 
tion, the upper and lower fault coverage bounds are calcu- 
lated as functions of control performance threshold. The 
results are shown in Fig. 3. The implications of these plots 


are obvious. When the control performance threshold value 
is requiied to be no less than 0.65, for example, controller 
1 ought to be selected. Fig.4 illustrates the result of a sim- 
ulation for a switched control system. The system begins 
by using controller 2. The result of no switching is shown 
in Fig.4: a) after the simulated reduction control effective- 
ness occurs; while in Fig. 4(b), controller 2 is switched to 
controller 1 three seconds after the effectiveness reduction 
occurs References 

[1] Balas, G.J., Doyle, J.C., Glover, K.. Packard, A., and 
Smith, R., /j - Analysis and Synthesis Toolbox (for use with 
MATLAB), Chapter 7, The Math Works, 1995. 

[2] Wu, N.E., and Chen, T.J., Feedback design in control 
reconfig arable systems, International Journal of Robust and 
Nonlineir Control , vol.6, pp. 560-570, 1996. 

[3] Wu, N.E., Zhou, K, and Salomon, G., On Recon- 
figurabi ity, to appear in Proc . IFAC Symposium on Safe- 
process , 2000. 

[4] Wu, N.E., Zhang, Y., and Zhou, K., Detection, esti- 
mation, and accommodation of loss of control effectiveness, 
to appear in International Journal of Adaptive Control and 
Signal Processing , 2000. 

[5] Wu, N. E., and Klir, G., Optimal redundancy man- 
agemeui in reconfigurable control systems based on nor- 
malized nonspecificity, to appear in International Journal 
of Systems Science , 2000. 



Fig.l Control performance and threshold 



Fig. 2 probability and possibility distributions of a control 
effectiveness estimate 



Fig. 3 Coverage bounds versus performance threshold 


Fig.4 Step response without and with controller switch 





